Answers

SMB- Each SMB message is preceded by a NetBIOS 'session message' prefix (type 0x00, 4 bytes long, includes the length of the message). This is required to specify the length of the message. No NetBIOS session establishment.

If SMB and NBT interfaces are enabled, both methods are tried at the same time and the first to respond is used.If OS doesn't support SMB, NBT will be used.

SMB Over TCP layer :In previous version SMB traffic requires the NetBIOS over TCP (NBT) protocol to work on a TCP/IP transport. SMB Over TCP layer was Added from windows 2000/above. Removing the NetBIOS transport eliminates Broadcast and better DNS resolution
and file/printer sharing.

vista/above uses SMBV2.Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.

Just to point out, the posted captures show SMB and don't show NetBT, which is what NetBIOS would look like in a capture. If you notice, it shows "DstPort=Microsoft-DS(445)," which is DirectSMB. As Gopi said, Windows 2000 and all newer try both, but more
than likely DirectSMB is the one that responds first due to it's efficiency and speed over NetBT.

Previous to Windows2000, Microsoft OS could only use SMB over a NetBIOS session. This means that all SMB traffic
will start after NetBIOS session is established. It’s relies on TCP port 139. If we disabled the NetBIOS over TCP/IP, the SMB connectivity was interrupted.

At Windows 2000 and higher version, the OS support both NetBIOS sessions and Direct Hosting. And Direct Hosting of SMB over TCP uses TCP port 445. Since Direct Hosting is not reliant on NetBIOS,
NetBIOS over TCP/IP can be disabled and connectivity to resources via SMB is still possible to other machines.

All replies

SMB- Each SMB message is preceded by a NetBIOS 'session message' prefix (type 0x00, 4 bytes long, includes the length of the message). This is required to specify the length of the message. No NetBIOS session establishment.

If SMB and NBT interfaces are enabled, both methods are tried at the same time and the first to respond is used.If OS doesn't support SMB, NBT will be used.

SMB Over TCP layer :In previous version SMB traffic requires the NetBIOS over TCP (NBT) protocol to work on a TCP/IP transport. SMB Over TCP layer was Added from windows 2000/above. Removing the NetBIOS transport eliminates Broadcast and better DNS resolution
and file/printer sharing.

vista/above uses SMBV2.Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.

Just to point out, the posted captures show SMB and don't show NetBT, which is what NetBIOS would look like in a capture. If you notice, it shows "DstPort=Microsoft-DS(445)," which is DirectSMB. As Gopi said, Windows 2000 and all newer try both, but more
than likely DirectSMB is the one that responds first due to it's efficiency and speed over NetBT.

Previous to Windows2000, Microsoft OS could only use SMB over a NetBIOS session. This means that all SMB traffic
will start after NetBIOS session is established. It’s relies on TCP port 139. If we disabled the NetBIOS over TCP/IP, the SMB connectivity was interrupted.

At Windows 2000 and higher version, the OS support both NetBIOS sessions and Direct Hosting. And Direct Hosting of SMB over TCP uses TCP port 445. Since Direct Hosting is not reliant on NetBIOS,
NetBIOS over TCP/IP can be disabled and connectivity to resources via SMB is still possible to other machines.

Great post, Aiden! The only caveat I see with disabling NetBIOS are legacy apps that rely on it that don't use DirectSMB, and the browser service for those accustomed to the neighborhood in a multi-subnetted environment.

DNS (this is where the search suffix comes in play if a single name query)

However, to dertermine if you need WINS or not or rather, NetBIOS, is something you must evaluate, such as any apps, services (Echange 2003, SQL, McAfee ePO, Symantec AV, Backup Exec, VPN clients expecting to browse the network, and much much more)
need NetBIOS. WINS extends this for multiple subnets, because NetBIOS is blocked at a router.